CVE-2009-1955
published 2009-06-08CVE-2009-1955: The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache…
PriorityP359high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EXPLOIT
EPSS
52.99%
98.9th percentile
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apr-util | < 1.3.7 | 1.3.7 |
| apache | apr-util | >= 0 < 1.3.7+dfsg-1 | 1.3.7+dfsg-1 |
| apache | apr-util | >= 0 < 1.3.7+dfsg-1 | 1.3.7+dfsg-1 |
| apache | apr-util | >= 0 < 1.3.7+dfsg-1 | 1.3.7+dfsg-1 |
| apache | apr-util | >= 0 < 1.3.7+dfsg-1 | 1.3.7+dfsg-1 |
| apache | http_server | >= 2.2.0 < 2.2.12 | 2.2.12 |
| apple | mac_os_x | < 10.6.2 | 10.6.2 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | apr-util | < apr-util 1.3.7+dfsg-1 (bookworm) | apr-util 1.3.7+dfsg-1 (bookworm) |
| debian | apr-util | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux | — | — |
| suse | linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for HTTP PROPFIND requests containing deeply nested XML entity references (billion laughs pattern) targeting mod_dav or mod_dav_svn endpoints. ↗
- →Look for PROPFIND requests with a Content-Type of text/xml and unusually large Content-Length values, which may indicate a crafted XML entity expansion payload. ↗
- →Monitor for rapid repeated PROPFIND connections in a tight loop from the same source IP, indicative of the exploit's continuous DoS loop. ↗
- →Alert on XML payloads in PROPFIND request bodies that define a large chain of nested entity references (e.g., &x0; referencing &x1; referencing &x2; etc.) consistent with exponential entity expansion. ↗
- ·The vulnerability is only exploitable on servers with mod_dav or mod_dav_svn enabled; systems not using these modules are not at risk. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-75fh-5jm2-jr94: The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2016-6312 [HIGH] CWE-400 GHSA-75fh-5jm2-jr94: The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5
The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion during entity expansion, which allows remote authenticated users with access to the webdav repository to cause a denial of service (memory consumption and httpd crash). NOTE: Exists as a regression to CVE-2009-1955.
GHSA
GHSA-hfr6-pxvf-frf7: The expat XML parser in the apr_xml_* interface in xml/apr_xml
ghsa_unreviewed·2022-05-02·CVSS 6.5
CVE-2009-1955 [MEDIUM] CWE-776 GHSA-hfr6-pxvf-frf7: The expat XML parser in the apr_xml_* interface in xml/apr_xml
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
OSV
CVE-2009-1955: The expat XML parser in the apr_xml_* interface in xml/apr_xml
osv·2009-06-08·CVSS 6.5
CVE-2009-1955 [MEDIUM] CVE-2009-1955: The expat XML parser in the apr_xml_* interface in xml/apr_xml
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
Red Hat
httpd: Billion laughs attack regression
vendor_redhat·2016-08-04·CVSS 7.5
CVE-2016-6312 [HIGH] httpd: Billion laughs attack regression
httpd: Billion laughs attack regression
The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion during entity expansion, which allows remote authenticated users with access to the webdav repository to cause a denial of service (memory consumption and httpd crash). NOTE: Exists as a regression to CVE-2009-1955.
A denial of service vulnerability was found in subversion. The mod_dontdothat component of the mod_dav_svn Apache module did not properly protect against exponential XML entity expansion attacks. An attacker with credentials to the webdav repository could send a crafted message that would result in resource exhaustion and denial of service to httpd.
Statement: Red Hat Product Securi
Debian
CVE-2016-6312: apr-util - The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as p...
vendor_debian·2016·CVSS 7.5
CVE-2016-6312 [HIGH] CVE-2016-6312: apr-util - The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as p...
The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion during entity expansion, which allows remote authenticated users with access to the webdav repository to cause a denial of service (memory consumption and httpd crash). NOTE: Exists as a regression to CVE-2009-1955.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Ubuntu
Apache vulnerabilities
vendor_ubuntu·2009-06-11·CVSS 4.3
CVE-2009-1195 [MEDIUM] Apache vulnerabilities
Title: Apache vulnerabilities
Summary: Apache vulnerabilities
Matthew Palmer discovered an underflow flaw in apr-util as included in
Apache. An attacker could cause a denial of service via application crash
in Apache using a crafted SVNMasterURI directive, .htaccess file, or when
using mod_apreq2. This issue only affected Ubuntu 6.06 LTS. (CVE-2009-0023)
Sander de Boer discovered that mod_proxy_ajp would reuse connections when
a client closed a connection without sending a request body. A remote
attacker could exploit this to obtain sensitive response data. This issue
only affected Ubuntu 9.04. (CVE-2009-1191)
Jonathan Peatfield discovered that Apache did not process Includes options
correctly. With certain configurations of Options and AllowOverride, a
local attacker could use an .hta
Ubuntu
apr-util vulnerabilities
vendor_ubuntu·2009-06-10·CVSS 4.3
CVE-2009-0023 [MEDIUM] apr-util vulnerabilities
Title: apr-util vulnerabilities
Summary: apr-util vulnerabilities
Matthew Palmer discovered an underflow flaw in apr-util. An attacker could
cause a denial of service via application crash in Apache using a crafted
SVNMasterURI directive, .htaccess file, or when using mod_apreq2.
Applications using libapreq2 are also affected. (CVE-2009-0023)
It was discovered that the XML parser did not properly handle entity
expansion. A remote attacker could cause a denial of service via memory
resource consumption by sending a crafted request to an Apache server
configured to use mod_dav or mod_dav_svn. (CVE-2009-1955)
C. Michael Pilato discovered an off-by-one buffer overflow in apr-util when
formatting certain strings. For big-endian machines (powerpc, hppa and
sparc in Ubuntu), a remote attacker
Red Hat
apr-util billion laughs attack
vendor_redhat·2009-06-01·CVSS 6.5
CVE-2009-1955 [MEDIUM] apr-util billion laughs attack
apr-util billion laughs attack
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
Debian
CVE-2009-1955: apr-util - The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-u...
vendor_debian·2009·CVSS 6.5
CVE-2009-1955 [MEDIUM] CVE-2009-1955: apr-util - The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-u...
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
Scope: local
bookworm: resolved (fixed in 1.3.7+dfsg-1)
bullseye: resolved (fixed in 1.3.7+dfsg-1)
forky: resolved (fixed in 1.3.7+dfsg-1)
sid: resolved (fixed in 1.3.7+dfsg-1)
trixie: resolved (fixed in 1.3.7+dfsg-1)
No detection rules found.
Bugzilla
CVE-2016-6312 apr-util, httpd: Billion laughs attack regression
bugzilla·2016-08-04·CVSS 7.5
CVE-2016-6312 [HIGH] CVE-2016-6312 apr-util, httpd: Billion laughs attack regression
CVE-2016-6312 apr-util, httpd: Billion laughs attack regression
A regression was found on RHEL-5.11 making apr-util and httpd vulnerable to billion laughs attack, also known as CVE-2009-1955, again.
Discussion:
Statement:
Red Hat Product Security has rated this issue as having Moderate security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.
Bugzilla
CVE-2009-1955 apr-util billion laughs attack
bugzilla·2009-06-08·CVSS 6.5
CVE-2009-1955 [MEDIUM] CVE-2009-1955 apr-util billion laughs attack
CVE-2009-1955 apr-util billion laughs attack
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1955 to the following vulnerability:
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in
Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn
modules in the Apache HTTP Server, allows remote attackers to cause a
denial of service (memory consumption) via a crafted XML document
containing a large number of nested entity references, as demonstrated
by a PROPFIND request, a similar issue to CVE-2003-1564.
Discussion:
*** Bug 503814 has been marked as a duplicate of this bug. ***
---
Public exploit posted to milw0rm:
http://www.milw0rm.com/exploits/8842
Upstream patch:
http://svn.apache.org/viewvc?view=rev&revision=781403
http://marc.info/?l=a
CWE
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
mitre_cwe
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
Modes of Introduction:
Phase: Implementation
Phase: Operation
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (Other). If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly
CWE
Improper Handling of Highly Compressed Data (Data Amplification)
mitre_cwe·CVSS 6.5
[MEDIUM] CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Amplification, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory). System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Examples:
The DTD and the very brief XML below illustrate what is meant by an XML
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlhttp://marc.info/?l=apr-dev&m=124396021826125&w=2http://marc.info/?l=bugtraq&m=129190899612998&w=2http://secunia.com/advisories/34724http://secunia.com/advisories/35284http://secunia.com/advisories/35360http://secunia.com/advisories/35395http://secunia.com/advisories/35444http://secunia.com/advisories/35487http://secunia.com/advisories/35565http://secunia.com/advisories/35710http://secunia.com/advisories/35797http://secunia.com/advisories/35843http://secunia.com/advisories/36473http://secunia.com/advisories/37221http://security.gentoo.org/glsa/glsa-200907-03.xmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210http://support.apple.com/kb/HT3937http://svn.apache.org/viewvc?view=rev&revision=781403http://wiki.rpath.com/Advisories:rPSA-2009-0123http://www-01.ibm.com/support/docview.wss?uid=swg1PK88342http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478http://www-01.ibm.com/support/docview.wss?uid=swg27014463http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3http://www.debian.org/security/2009/dsa-1812http://www.mandriva.com/security/advisories?name=MDVSA-2009:131http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.openwall.com/lists/oss-security/2009/06/03/4http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1107.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1108.htmlhttp://www.securityfocus.com/archive/1/506053/100/0/threadedhttp://www.securityfocus.com/bid/35253http://www.ubuntu.com/usn/usn-786-1http://www.ubuntu.com/usn/usn-787-1http://www.vupen.com/english/advisories/2009/1907http://www.vupen.com/english/advisories/2009/3184http://www.vupen.com/english/advisories/2010/1107https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10270https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12473https://www.exploit-db.com/exploits/8842https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.htmlhttp://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlhttp://marc.info/?l=apr-dev&m=124396021826125&w=2http://marc.info/?l=bugtraq&m=129190899612998&w=2http://secunia.com/advisories/34724http://secunia.com/advisories/35284http://secunia.com/advisories/35360http://secunia.com/advisories/35395http://secunia.com/advisories/35444http://secunia.com/advisories/35487http://secunia.com/advisories/35565http://secunia.com/advisories/35710http://secunia.com/advisories/35797http://secunia.com/advisories/35843http://secunia.com/advisories/36473http://secunia.com/advisories/37221http://security.gentoo.org/glsa/glsa-200907-03.xmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210http://support.apple.com/kb/HT3937http://svn.apache.org/viewvc?view=rev&revision=781403http://wiki.rpath.com/Advisories:rPSA-2009-0123http://www-01.ibm.com/support/docview.wss?uid=swg1PK88342http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478http://www-01.ibm.com/support/docview.wss?uid=swg27014463http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3http://www.debian.org/security/2009/dsa-1812http://www.mandriva.com/security/advisories?name=MDVSA-2009:131http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.openwall.com/lists/oss-security/2009/06/03/4http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1107.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1108.htmlhttp://www.securityfocus.com/archive/1/506053/100/0/threadedhttp://www.securityfocus.com/bid/35253http://www.ubuntu.com/usn/usn-786-1http://www.ubuntu.com/usn/usn-787-1http://www.vupen.com/english/advisories/2009/1907http://www.vupen.com/english/advisories/2009/3184http://www.vupen.com/english/advisories/2010/1107
+ 20 more references
2009-06-08
Published